![将流量转发到单独命名空间中的虚拟以太网适配器时出现“网络不可达”](https://linux22.com/image/1553852/%E5%B0%86%E6%B5%81%E9%87%8F%E8%BD%AC%E5%8F%91%E5%88%B0%E5%8D%95%E7%8B%AC%E5%91%BD%E5%90%8D%E7%A9%BA%E9%97%B4%E4%B8%AD%E7%9A%84%E8%99%9A%E6%8B%9F%E4%BB%A5%E5%A4%AA%E7%BD%91%E9%80%82%E9%85%8D%E5%99%A8%E6%97%B6%E5%87%BA%E7%8E%B0%E2%80%9C%E7%BD%91%E7%BB%9C%E4%B8%8D%E5%8F%AF%E8%BE%BE%E2%80%9D.png)
我的目标是在我的 Linux 服务器上设置一个单独的命名空间,用于 OpenVPN 连接,然后用于 VirtualBox 主机。
到目前为止我已经遵循了以下步骤:
- 设置cronjob
@reboot /home/ubuntu/startupscripts/rootscripts.sh
- 在 shell 脚本中执行:(改编自此处)
# Setup VPN ip netns add vpnspace ip link add vpnopen type veth peer name vpnbind ip link set vpnopen netns vpnspace ip netns exec vpnspace /sbin/ifconfig vpnopen 10.0.0.1/24 up
(见问题)/sbin/ifconfig vpnbind up
** - 添加了下面的 iptables 规则并重新配置了 iptables-persistent(改编自) (见问题)
-A FORWARD -i vpnbind -o ens3 -j ACCEPT -A FORWARD -i ens3 -o vpnbind -m state --state ESTABLISHED,RELATED -j ACCEPT -t nat -A POSTROUTING -o eth0 -j MASQUERADE
**我添加了这一步骤,因为sudo lshw -C network
显示网络连接未处于活动状态。(见问题)
当我尝试sudo ip netns exec vpnspace ping 8.8.8.8
从终端时,我收到错误消息connect: Network is unreachable
。我不知道接下来该怎么做。
以下是各种输出。如果您希望我添加其他输出,请在评论中告诉我们。
是否配置:
ens3 Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
inet addr:XXX.XXX.XXX.92 Bcast:XXX.225.222.255 Mask:255.255.255.0
inet6 addr: XXXX::XXXX:XXXX:XXXX:XXXX/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:44943 errors:16 dropped:0 overruns:0 frame:16
TX packets:467 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:3042544 (3.0 MB) TX bytes:49351 (49.3 KB)
lo Link encap:Local Loopback
inet addr:127.0.0.1 Mask:255.0.0.0
inet6 addr: ::1/128 Scope:Host
UP LOOPBACK RUNNING MTU:65536 Metric:1
RX packets:2 errors:0 dropped:0 overruns:0 frame:0
TX packets:2 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1
RX bytes:100 (100.0 B) TX bytes:100 (100.0 B)
vpnbind Link encap:Ethernet HWaddr XX:XX:XX:XX:XX:XX
inet6 addr: XXXX::XXXX:XXXX:XXXX:XXXX/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:8 errors:0 dropped:0 overruns:0 frame:0
TX packets:0 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:648 (648.0 B) TX bytes:0 (0.0 B)
sudo ip netns exec vpnspace ifconfig:
vpnopen Link encap:Ethernet HWaddr 36:28:6f:74:1b:72
inet addr:10.0.0.1 Bcast:10.0.0.255 Mask:255.255.255.0
inet6 addr: XXXX::XXXX:XXXX:XXXX:XXXX/64 Scope:Link
UP BROADCAST RUNNING MULTICAST MTU:1500 Metric:1
RX packets:0 errors:0 dropped:0 overruns:0 frame:0
TX packets:8 errors:0 dropped:0 overruns:0 carrier:0
collisions:0 txqueuelen:1000
RX bytes:0 (0.0 B) TX bytes:648 (648.0 B)
ip 链接显示:
1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN mode DEFAULT group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
2: ens3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP mode DEFAULT group default qlen 1000
link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff
3: vpnbind@if4: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff link-netnsid 0
sudo ip netns exec vpnspace ip link show:
1: lo: <LOOPBACK> mtu 65536 qdisc noop state DOWN mode DEFAULT group default qlen 1
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
4: vpnopen@if3: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP mode DEFAULT group default qlen 1000
link/ether XX:XX:XX:XX:XX:XX brd ff:ff:ff:ff:ff:ff link-netnsid 0
/etc/网络/接口:
# The loopback network interface
auto lo
iface lo inet loopback
# Preconfigured by my VPS provider
auto ens3
iface ens3 inet static
address XXX.XXX.XXX.92
netmask 255.255.255.0
broadcast +
up route -A inet add XXX.XXX.XXX.1 dev ens3
up route -A inet add default gw XXX.XXX.XXX.1 dev ens3
iface ens3 inet6 manual
pre-down ip -6 addr flush dev ens3 scope global || :
更新脚本
ip netns add vpnspace
ip link add vpnopen type veth peer name vpnbind
echo 1 > /proc/sys/net/ipv4/conf/ens3/forwarding
echo 1 > /proc/sys/net/ipv4/conf/vpnbind/forwarding
ip link set vpnbind up
ip link set vpnopen netns vpnspace
ip -n vpnspace addr add 10.0.0.1 dev vpnopen
ip -n vpnspace addr add 10.0.0.254 broadcast 10.0.0.255 dev vpnopen
ip -n vpnspace link set vpnopen up
ip -n vpnspace route add default via 10.0.0.254
答案1
您有指向其自身的默认路由vpnspace
。您应该将地址添加10.0.0.254
到vpnbind
而不是vpnopen
。
另外,您已将 10.0.0.0/8 全部分配给您的 veth 对,这将导致无法访问该地址范围内的其他主机。